Detections
Analytics

EulerOS 2.0 SP12 : pcre2 (EulerOS-SA-2026-4512)

high Nessus Plugin ID 376692

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the pcre2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.(CVE-2026-89160)

 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of- bounds write.(CVE-2026-89158)

 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.(CVE-2026-89161)

 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).(CVE-2026-86145)

 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.(CVE-2026-89156)

 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.(CVE-2026-89157)

Tenable has extracted the preceding description block directly from the EulerOS pcre2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected pcre2 packages.

See Also

http://www.nessus.org/u?8219802e

Plugin Details

Severity: High

ID: 376692

File Name: EulerOS_SA-2026-4512.nasl

Version: 1.1

Type: Local

Published: 11/6/2026

Updated: 11/6/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

Percentile: 95.85

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-89157

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-89161

Vulnerability Information

CPE: cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:pcre2-devel, p-cpe:/a:huawei:euleros:pcre2-help, p-cpe:/a:huawei:euleros:pcre2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 9/5/2026

Reference Information

CVE: CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161